Language Selection

English French German Italian Portuguese Spanish

Unpatched Firefox flaw may expose users

Filed under
Moz/FF
Security

A new, unpatched flaw in that affects all versions of Firefox could let attackers surreptitiously run malicious code on users' PCs, a security researcher has warned.

The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday.

He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site.

The security vulnerability is a buffer overflow flaw that "allows for an attacker to remotely execute arbitrary code" on a vulnerable PC, Ferris said. An attacker could host a Web site containing the malicious code to exploit the flaw, he said. Though his proof of concept only crashes Firefox, Ferris claims he has been able to tweak it to run code.

Severity:
Critical

Vendor:
Mozilla

Versions Affected:
Firefox Win32 1.0.6 and prior
Firefox Linux 1.0.6 and prior
Firefox 1.5 Beta 1 (Deer Park Alpha 2)

Full Story.

More in Tux Machines

Why the Open Source Stars Must Align

Open source projects like OpenStack, Docker, OPNFV and OpenDaylight are more supported and better funded than ever before. They mark a broader trend of large, active and well-resourced open source projects that are among the leaders in Big Data, cloud computing, operating systems and development practices. Open source has come a long way in 30 years – and its success marks a new era for the overall OSS community. But success does not come without potential pitfalls. One of the greatest obstacles to project success isn’t the proprietary competition – it’s the lack of communication between large open source projects like OpenStack and Docker. Read more

Myth Busting the Open-Source Cloud Part 1

On the contrary, open-source cloud computing products are designed from the outset with security in mind. For example, there are features such as identity management to monitor who has access to content, and data encryption to safeguard information while it’s at rest or in transit. Furthermore, open-source cloud software is peer-reviewed by community participants, leading to continuous improvements in the quality of security features and mechanisms. This community also monitors and rapidly discloses vulnerabilities and issues, and provides security updates to address them. Read more

What does an adult look like in an open source community?

You're no longer "just an adult." You're now trusted and looked to for opinions on how the community should grow. You're a community elder. You embody the history. You keep the history. You work together with other adults and elders to guide and make the community stronger. And to a certain extent, the community once again looks after you, just as it did in the first phase. Read more